<!DOCTYPE html>
<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/>
<title>test.yara</title>
<meta name="generator" content="KF5::SyntaxHighlighting - Definition (YARA) - Theme (Breeze Light)"/>
</head><body style="background-color:#ffffff;color:#1f1c1b"><pre>
<span style="color:#898887;">// Sample YARA file for Syntax Highlighting</span>
<span style="color:#898887;">// Obtained from: https://yara.readthedocs.io/en/stable/writingrules.html</span>

<span style="color:#898887;">/*</span>
<span style="color:#898887;">    This is a multi-line comment ...</span>
<span style="color:#898887;">*/</span>

<span style="font-weight:bold;">rule</span> <span style="color:#644a9b;">silent_banker</span> : banker
{
    <span style="font-weight:bold;">meta</span>:
        description = <span style="color:#bf0303;">&quot;This is just an example&quot;</span>
        threat_level = <span style="color:#b08000;">3</span>
        in_the_wild = <span style="color:#aa5500;">true</span>
    <span style="font-weight:bold;">strings</span>:
        <span style="color:#0057ae;">$a</span> = {<span style="color:#ff5500;">6A 40 68 00 30 00 00 6A 14 8D 91</span>}
        <span style="color:#0057ae;">$b</span> = {<span style="color:#ff5500;">8D 4D B0 2B C1 83 C0 27 99 6A 4E 59 F7 F9</span>}
        <span style="color:#0057ae;">$c</span> = <span style="color:#bf0303;">&quot;UVODFRYSIHLNWPEJXQZAKCBGMT&quot;</span>
    <span style="font-weight:bold;">condition</span>:
        <span style="color:#0057ae;">$a</span> <span style="font-weight:bold;">or</span> <span style="color:#0057ae;">$b</span> <span style="font-weight:bold;">or</span> <span style="color:#0057ae;">$c</span>
}

<span style="font-weight:bold;">rule</span> <span style="color:#644a9b;">dummy</span>
{
    <span style="font-weight:bold;">condition</span>:
       <span style="color:#aa5500;">false</span>
}

<span style="font-weight:bold;">rule</span> <span style="color:#644a9b;">ExampleRule</span>
{
    <span style="font-weight:bold;">strings</span>:
        <span style="color:#0057ae;">$my_text_string</span> = <span style="color:#bf0303;">&quot;text here&quot;</span>
        <span style="color:#0057ae;">$my_hex_string</span> = {<span style="color:#ff5500;"> E2 34 A1 C8 23 FB </span>}

    <span style="font-weight:bold;">condition</span>:
        <span style="color:#0057ae;">$my_text_string</span> <span style="font-weight:bold;">or</span> <span style="color:#0057ae;">$my_hex_string</span>
}

<span style="color:#898887;">// Hexadecimal strings</span>

<span style="font-weight:bold;">rule</span> <span style="color:#644a9b;">WildcardExample</span>
{
    <span style="font-weight:bold;">strings</span>:
       <span style="color:#0057ae;">$hex_string</span> = {<span style="color:#ff5500;"> E2 34 ?? C8 A? FB </span>}

    <span style="font-weight:bold;">condition</span>:
       <span style="color:#0057ae;">$hex_string</span>
}

<span style="font-weight:bold;">rule</span> <span style="color:#644a9b;">JumpExample</span>
{
        <span style="font-weight:bold;">strings</span>:
           <span style="color:#0057ae;">$hex_string</span> = {<span style="color:#ff5500;"> F4 23 </span>[<span style="color:#b08000;">4</span>-<span style="color:#b08000;">6</span>]<span style="color:#ff5500;"> 62 B4 </span>}

        <span style="font-weight:bold;">condition</span>:
           <span style="color:#0057ae;">$hex_string</span>
}

<span style="font-weight:bold;">rule</span> <span style="color:#644a9b;">AlternativesExample</span>
{
    <span style="font-weight:bold;">strings</span>:
       <span style="color:#0057ae;">$hex_string</span> = {<span style="color:#ff5500;"> F4 23 </span>(<span style="color:#ff5500;"> 62 B4 </span>|<span style="color:#ff5500;"> 56 </span>|<span style="color:#ff5500;"> 45 ?? 67 </span>)<span style="color:#ff5500;"> 45 </span>}

    <span style="font-weight:bold;">condition</span>:
       <span style="color:#0057ae;">$hex_string</span>
}

<span style="color:#898887;">// Text strings</span>

<span style="font-weight:bold;">rule</span> <span style="color:#644a9b;">CaseInsensitiveTextExample</span>
{
    <span style="font-weight:bold;">strings</span>:
        <span style="color:#0057ae;">$text_string</span> = <span style="color:#bf0303;">&quot;foobar&quot;</span> <span style="font-weight:bold;">nocase</span>

    <span style="font-weight:bold;">condition</span>:
        <span style="color:#0057ae;">$text_string</span>
}

<span style="font-weight:bold;">rule</span> <span style="color:#644a9b;">WideCharTextExample</span>
{
    <span style="font-weight:bold;">strings</span>:
        <span style="color:#0057ae;">$wide_and_ascii_string</span> = <span style="color:#bf0303;">&quot;Borland&quot;</span> <span style="font-weight:bold;">wide</span> <span style="font-weight:bold;">ascii</span>

    <span style="font-weight:bold;">condition</span>:
       <span style="color:#0057ae;">$wide_and_ascii_string</span>
}

<span style="color:#898887;">// XOR strings</span>

<span style="font-weight:bold;">rule</span> <span style="color:#644a9b;">XorExample1</span>
{
    <span style="font-weight:bold;">strings</span>:
        <span style="color:#0057ae;">$xor_string</span> = <span style="color:#bf0303;">&quot;This program cannot&quot;</span> <span style="font-weight:bold;">xor</span>

    <span style="font-weight:bold;">condition</span>:
        <span style="color:#0057ae;">$xor_string</span>
}

<span style="font-weight:bold;">rule</span> <span style="color:#644a9b;">XorExample2</span>
{
    <span style="font-weight:bold;">strings</span>:
        <span style="color:#0057ae;">$xor_string_00</span> = <span style="color:#bf0303;">&quot;This program cannot&quot;</span>
        <span style="color:#0057ae;">$xor_string_01</span> = <span style="color:#bf0303;">&quot;Uihr!qsnfs`l!b`oonu&quot;</span>
        <span style="color:#0057ae;">$xor_string_02</span> = <span style="color:#bf0303;">&quot;Vjkq</span><span style="color:#3daee9;">\&quot;</span><span style="color:#bf0303;">rpmepco</span><span style="color:#3daee9;">\&quot;</span><span style="color:#bf0303;">acllmv&quot;</span>
        <span style="color:#898887;">// Repeat for every single byte XOR</span>
    <span style="font-weight:bold;">condition</span>:
        <span style="font-weight:bold;">any</span> <span style="font-weight:bold;">of</span> <span style="font-weight:bold;">them</span>
}

<span style="font-weight:bold;">rule</span> <span style="color:#644a9b;">XorExample3</span>
{
    <span style="font-weight:bold;">strings</span>:
        <span style="color:#0057ae;">$xor_string</span> = <span style="color:#bf0303;">&quot;This program cannot&quot;</span> <span style="font-weight:bold;">xor</span> <span style="font-weight:bold;">wide</span> <span style="font-weight:bold;">ascii</span>
    <span style="font-weight:bold;">condition</span>:
        <span style="color:#0057ae;">$xor_string</span>
}

<span style="font-weight:bold;">rule</span> <span style="color:#644a9b;">XorExample4</span>
{
    <span style="font-weight:bold;">strings</span>:
        <span style="color:#0057ae;">$xor_string_00</span> = <span style="color:#bf0303;">&quot;T</span><span style="color:#3daee9;">\x00</span><span style="color:#bf0303;">h</span><span style="color:#3daee9;">\x00</span><span style="color:#bf0303;">i</span><span style="color:#3daee9;">\x00</span><span style="color:#bf0303;">s</span><span style="color:#3daee9;">\x00</span><span style="color:#bf0303;"> </span><span style="color:#3daee9;">\x00</span><span style="color:#bf0303;">p</span><span style="color:#3daee9;">\x00</span><span style="color:#bf0303;">r</span><span style="color:#3daee9;">\x00</span><span style="color:#bf0303;">o</span><span style="color:#3daee9;">\x00</span><span style="color:#bf0303;">g</span><span style="color:#3daee9;">\x00</span><span style="color:#bf0303;">r</span><span style="color:#3daee9;">\x00</span><span style="color:#bf0303;">a</span><span style="color:#3daee9;">\x00</span><span style="color:#bf0303;">m</span><span style="color:#3daee9;">\x00</span><span style="color:#bf0303;"> </span><span style="color:#3daee9;">\x00</span><span style="color:#bf0303;">c</span><span style="color:#3daee9;">\x00</span><span style="color:#bf0303;">a</span><span style="color:#3daee9;">\x00</span><span style="color:#bf0303;">n</span><span style="color:#3daee9;">\x00</span><span style="color:#bf0303;">n</span><span style="color:#3daee9;">\x00</span><span style="color:#bf0303;">o</span><span style="color:#3daee9;">\x00</span><span style="color:#bf0303;">t</span><span style="color:#3daee9;">\x00</span><span style="color:#bf0303;">&quot;</span>
        <span style="color:#0057ae;">$xor_string_01</span> = <span style="color:#bf0303;">&quot;U</span><span style="color:#3daee9;">\x01</span><span style="color:#bf0303;">i</span><span style="color:#3daee9;">\x01</span><span style="color:#bf0303;">h</span><span style="color:#3daee9;">\x01</span><span style="color:#bf0303;">r</span><span style="color:#3daee9;">\x01</span><span style="color:#bf0303;">!</span><span style="color:#3daee9;">\x01</span><span style="color:#bf0303;">q</span><span style="color:#3daee9;">\x01</span><span style="color:#bf0303;">s</span><span style="color:#3daee9;">\x01</span><span style="color:#bf0303;">n</span><span style="color:#3daee9;">\x01</span><span style="color:#bf0303;">f</span><span style="color:#3daee9;">\x01</span><span style="color:#bf0303;">s</span><span style="color:#3daee9;">\x01</span><span style="color:#bf0303;">`</span><span style="color:#3daee9;">\x01</span><span style="color:#bf0303;">l</span><span style="color:#3daee9;">\x01</span><span style="color:#bf0303;">!</span><span style="color:#3daee9;">\x01</span><span style="color:#bf0303;">b</span><span style="color:#3daee9;">\x01</span><span style="color:#bf0303;">`</span><span style="color:#3daee9;">\x01</span><span style="color:#bf0303;">o</span><span style="color:#3daee9;">\x01</span><span style="color:#bf0303;">o</span><span style="color:#3daee9;">\x01</span><span style="color:#bf0303;">n</span><span style="color:#3daee9;">\x01</span><span style="color:#bf0303;">u</span><span style="color:#3daee9;">\x01</span><span style="color:#bf0303;">&quot;</span>
        <span style="color:#0057ae;">$xor_string_02</span> = <span style="color:#bf0303;">&quot;V</span><span style="color:#3daee9;">\x02</span><span style="color:#bf0303;">j</span><span style="color:#3daee9;">\x02</span><span style="color:#bf0303;">k</span><span style="color:#3daee9;">\x02</span><span style="color:#bf0303;">q</span><span style="color:#3daee9;">\x02\&quot;\x02</span><span style="color:#bf0303;">r</span><span style="color:#3daee9;">\x02</span><span style="color:#bf0303;">p</span><span style="color:#3daee9;">\x02</span><span style="color:#bf0303;">m</span><span style="color:#3daee9;">\x02</span><span style="color:#bf0303;">e</span><span style="color:#3daee9;">\x02</span><span style="color:#bf0303;">p</span><span style="color:#3daee9;">\x02</span><span style="color:#bf0303;">c</span><span style="color:#3daee9;">\x02</span><span style="color:#bf0303;">o</span><span style="color:#3daee9;">\x02\&quot;\x02</span><span style="color:#bf0303;">a</span><span style="color:#3daee9;">\x02</span><span style="color:#bf0303;">c</span><span style="color:#3daee9;">\x02</span><span style="color:#bf0303;">l</span><span style="color:#3daee9;">\x02</span><span style="color:#bf0303;">l</span><span style="color:#3daee9;">\x02</span><span style="color:#bf0303;">m</span><span style="color:#3daee9;">\x02</span><span style="color:#bf0303;">v</span><span style="color:#3daee9;">\x02</span><span style="color:#bf0303;">&quot;</span>
        <span style="color:#898887;">// Repeat for every single byte XOR operation.</span>
    <span style="font-weight:bold;">condition</span>:
        <span style="font-weight:bold;">any</span> <span style="font-weight:bold;">of</span> <span style="font-weight:bold;">them</span>
}

<span style="font-weight:bold;">rule</span> <span style="color:#644a9b;">XorExample5</span>
{
    <span style="font-weight:bold;">strings</span>:
        <span style="color:#0057ae;">$xor_string</span> = <span style="color:#bf0303;">&quot;This program cannot&quot;</span> <span style="font-weight:bold;">xor</span>(<span style="color:#b08000;">0x01</span>-<span style="color:#b08000;">0xff</span>)
    <span style="font-weight:bold;">condition</span>:
        <span style="color:#0057ae;">$xor_string</span>
}

<span style="color:#898887;">// Base64 strings</span>

<span style="font-weight:bold;">rule</span> <span style="color:#644a9b;">Base64Example1</span>
{
    <span style="font-weight:bold;">strings</span>:
        <span style="color:#0057ae;">$a</span> = <span style="color:#bf0303;">&quot;This program cannot&quot;</span> <span style="font-weight:bold;">base64</span>

    <span style="font-weight:bold;">condition</span>:
        <span style="color:#0057ae;">$a</span>
}

<span style="font-weight:bold;">rule</span> <span style="color:#644a9b;">Base64Example2</span>
{
    <span style="font-weight:bold;">strings</span>:
        <span style="color:#0057ae;">$a</span> = <span style="color:#bf0303;">&quot;This program cannot&quot;</span> <span style="font-weight:bold;">base64</span>(<span style="color:#bf0303;">&quot;!@#$%^&amp;*(){}[].,|ABCDEFGHIJ</span><span style="color:#3daee9;">\x09</span><span style="color:#bf0303;">LMNOPQRSTUVWXYZabcdefghijklmnopqrstu&quot;</span>)

    <span style="font-weight:bold;">condition</span>:
        <span style="color:#0057ae;">$a</span>
}

<span style="color:#898887;">// Regular expressions</span>

<span style="font-weight:bold;">rule</span> <span style="color:#644a9b;">RegExpExample1</span>
{
    <span style="font-weight:bold;">strings</span>:
        <span style="color:#0057ae;">$re1</span> = <span style="color:#ff5500;">/</span><span style="color:#ff5500;">md5: </span><span style="color:#3daee9;">[0-9a-fA-F]</span><span style="color:#3daee9;">{32}</span><span style="color:#ff5500;">/</span>
        <span style="color:#0057ae;">$re2</span> = <span style="color:#ff5500;">/</span><span style="color:#ff5500;">state: </span><span style="color:#3daee9;">(</span><span style="color:#ff5500;">on</span><span style="color:#3daee9;">|</span><span style="color:#ff5500;">off</span><span style="color:#3daee9;">)</span><span style="color:#ff5500;">/</span>

    <span style="font-weight:bold;">condition</span>:
        <span style="color:#0057ae;">$re1</span> <span style="font-weight:bold;">and</span> <span style="color:#0057ae;">$re2</span>
}

<span style="color:#898887;">// Conditions</span>

<span style="font-weight:bold;">rule</span> <span style="color:#644a9b;">Example</span>
{
    <span style="font-weight:bold;">strings</span>:
        <span style="color:#0057ae;">$a</span> = <span style="color:#bf0303;">&quot;text1&quot;</span>
        <span style="color:#0057ae;">$b</span> = <span style="color:#bf0303;">&quot;text2&quot;</span>
        <span style="color:#0057ae;">$c</span> = <span style="color:#bf0303;">&quot;text3&quot;</span>
        <span style="color:#0057ae;">$d</span> = <span style="color:#bf0303;">&quot;text4&quot;</span>

    <span style="font-weight:bold;">condition</span>:
        (<span style="color:#0057ae;">$a</span> <span style="font-weight:bold;">or</span> <span style="color:#0057ae;">$b</span>) <span style="font-weight:bold;">and</span> (<span style="color:#0057ae;">$c</span> <span style="font-weight:bold;">or</span> <span style="color:#0057ae;">$d</span>)
}

<span style="font-weight:bold;">rule</span> <span style="color:#644a9b;">CountExample</span>
{
    <span style="font-weight:bold;">strings</span>:
        <span style="color:#0057ae;">$a</span> = <span style="color:#bf0303;">&quot;dummy1&quot;</span>
        <span style="color:#0057ae;">$b</span> = <span style="color:#bf0303;">&quot;dummy2&quot;</span>

    <span style="font-weight:bold;">condition</span>:
        #a == <span style="color:#b08000;">6</span> <span style="font-weight:bold;">and</span> #b &gt; <span style="color:#b08000;">10</span>
}


<span style="font-weight:bold;">rule</span> <span style="color:#644a9b;">AtExample</span>
{
    <span style="font-weight:bold;">strings</span>:
        <span style="color:#0057ae;">$a</span> = <span style="color:#bf0303;">&quot;dummy1&quot;</span>
        <span style="color:#0057ae;">$b</span> = <span style="color:#bf0303;">&quot;dummy2&quot;</span>

    <span style="font-weight:bold;">condition</span>:
        <span style="color:#0057ae;">$a</span> <span style="font-weight:bold;">at</span> <span style="color:#b08000;">100</span> <span style="font-weight:bold;">and</span> <span style="color:#0057ae;">$b</span> <span style="font-weight:bold;">at</span> <span style="color:#b08000;">200</span>
}

<span style="font-weight:bold;">rule</span> <span style="color:#644a9b;">InExample</span>
{
    <span style="font-weight:bold;">strings</span>:
        <span style="color:#0057ae;">$a</span> = <span style="color:#bf0303;">&quot;dummy1&quot;</span>
        <span style="color:#0057ae;">$b</span> = <span style="color:#bf0303;">&quot;dummy2&quot;</span>

    <span style="font-weight:bold;">condition</span>:
        <span style="color:#0057ae;">$a</span> <span style="font-weight:bold;">in</span> (<span style="color:#b08000;">0..100</span>) <span style="font-weight:bold;">and</span> <span style="color:#0057ae;">$b</span> <span style="font-weight:bold;">in</span> (<span style="color:#b08000;">100.</span>.<span style="font-weight:bold;">filesize</span>)
}

<span style="color:#898887;">// File size</span>

<span style="font-weight:bold;">rule</span> <span style="color:#644a9b;">FileSizeExample</span>
{
    <span style="font-weight:bold;">condition</span>:
       <span style="font-weight:bold;">filesize</span> &gt; <span style="color:#b08000;">200</span>KB
}

<span style="color:#898887;">// Executable entry point</span>

<span style="font-weight:bold;">rule</span> <span style="color:#644a9b;">EntryPointExample</span>
{
    <span style="font-weight:bold;">strings</span>:
        <span style="color:#0057ae;">$a</span> = {<span style="color:#ff5500;"> 9C 50 66 A1 ?? ?? ?? 00 66 A9 ?? ?? 58 0F 85 </span>}

    <span style="font-weight:bold;">condition</span>:
       <span style="color:#0057ae;">$a</span> <span style="font-weight:bold;">in</span> (<span style="font-weight:bold;">entrypoint</span>..<span style="font-weight:bold;">entrypoint</span> + <span style="color:#b08000;">10</span>)
}


<span style="color:#898887;">// Accessing data at a given position</span>

<span style="font-weight:bold;">rule</span> <span style="color:#644a9b;">IsPE</span>
{
  <span style="font-weight:bold;">condition</span>:
     <span style="color:#898887;">// MZ signature at offset 0 and ...</span>
     <span style="font-weight:bold;">uint16</span>(<span style="color:#b08000;">0</span>) == <span style="color:#b08000;">0x5A4D</span> <span style="font-weight:bold;">and</span>
     <span style="color:#898887;">// ... PE signature at offset stored in MZ header at 0x3C</span>
     <span style="font-weight:bold;">uint32</span>(<span style="font-weight:bold;">uint32</span>(<span style="color:#b08000;">0x3C</span>)) == <span style="color:#b08000;">0x00004550</span>
}

<span style="color:#898887;">// Sets of strings</span>

<span style="font-weight:bold;">rule</span> <span style="color:#644a9b;">OfExample1</span>
{
    <span style="font-weight:bold;">strings</span>:
        <span style="color:#0057ae;">$a</span> = <span style="color:#bf0303;">&quot;dummy1&quot;</span>
        <span style="color:#0057ae;">$b</span> = <span style="color:#bf0303;">&quot;dummy2&quot;</span>
        <span style="color:#0057ae;">$c</span> = <span style="color:#bf0303;">&quot;dummy3&quot;</span>

    <span style="font-weight:bold;">condition</span>:
        <span style="color:#b08000;">2</span> <span style="font-weight:bold;">of</span> (<span style="color:#0057ae;">$a</span>,<span style="color:#0057ae;">$b</span>,<span style="color:#0057ae;">$c</span>)
}

<span style="font-weight:bold;">rule</span> <span style="color:#644a9b;">OfExample2</span>
{
    <span style="font-weight:bold;">strings</span>:
        <span style="color:#0057ae;">$foo1</span> = <span style="color:#bf0303;">&quot;foo1&quot;</span>
        <span style="color:#0057ae;">$foo2</span> = <span style="color:#bf0303;">&quot;foo2&quot;</span>
        <span style="color:#0057ae;">$foo3</span> = <span style="color:#bf0303;">&quot;foo3&quot;</span>

    <span style="font-weight:bold;">condition</span>:
        <span style="color:#b08000;">2</span> <span style="font-weight:bold;">of</span> (<span style="color:#0057ae;">$foo</span>*)  <span style="color:#898887;">// equivalent to 2 of ($foo1,$foo2,$foo3)</span>
}

<span style="font-weight:bold;">rule</span> <span style="color:#644a9b;">OfExample3</span>
{
    <span style="font-weight:bold;">strings</span>:
        <span style="color:#0057ae;">$a</span> = <span style="color:#bf0303;">&quot;dummy1&quot;</span>
        <span style="color:#0057ae;">$b</span> = <span style="color:#bf0303;">&quot;dummy2&quot;</span>
        <span style="color:#0057ae;">$c</span> = <span style="color:#bf0303;">&quot;dummy3&quot;</span>

    <span style="font-weight:bold;">condition</span>:
        <span style="color:#b08000;">1</span> <span style="font-weight:bold;">of</span> <span style="font-weight:bold;">them</span> <span style="color:#898887;">// equivalent to 1 of ($*)</span>
}

<span style="color:#898887;">// Iterating over string occurrences</span>

<span style="font-weight:bold;">rule</span> <span style="color:#644a9b;">Occurrences</span>
{
    <span style="font-weight:bold;">strings</span>:
        <span style="color:#0057ae;">$a</span> = <span style="color:#bf0303;">&quot;dummy1&quot;</span>
        <span style="color:#0057ae;">$b</span> = <span style="color:#bf0303;">&quot;dummy2&quot;</span>

    <span style="font-weight:bold;">condition</span>:
        <span style="font-weight:bold;">for</span> <span style="font-weight:bold;">all</span> i <span style="font-weight:bold;">in</span> (<span style="color:#b08000;">1</span>,<span style="color:#b08000;">2</span>,<span style="color:#b08000;">3</span>) : ( @a[i] + <span style="color:#b08000;">10</span> == @b[i] )
}

<span style="color:#898887;">// Referencing other rules</span>

<span style="font-weight:bold;">rule</span> <span style="color:#644a9b;">Rule1</span>
{
    <span style="font-weight:bold;">strings</span>:
        <span style="color:#0057ae;">$a</span> = <span style="color:#bf0303;">&quot;dummy1&quot;</span>

    <span style="font-weight:bold;">condition</span>:
        <span style="color:#0057ae;">$a</span>
}

<span style="font-weight:bold;">rule</span> <span style="color:#644a9b;">Rule2</span>
{
    <span style="font-weight:bold;">strings</span>:
        <span style="color:#0057ae;">$a</span> = <span style="color:#bf0303;">&quot;dummy2&quot;</span>

    <span style="font-weight:bold;">condition</span>:
        <span style="color:#0057ae;">$a</span> <span style="font-weight:bold;">and</span> Rule1
}

<span style="color:#898887;">// Metadata</span>

<span style="font-weight:bold;">rule</span> <span style="color:#644a9b;">MetadataExample</span>
{
    <span style="font-weight:bold;">meta</span>:
        my_identifier_1 = <span style="color:#bf0303;">&quot;Some string data&quot;</span>
        my_identifier_2 = <span style="color:#b08000;">24</span>
        my_identifier_3 = <span style="color:#aa5500;">true</span>

    <span style="font-weight:bold;">strings</span>:
        <span style="color:#0057ae;">$my_text_string</span> = <span style="color:#bf0303;">&quot;text here&quot;</span>
        <span style="color:#0057ae;">$my_hex_string</span> = {<span style="color:#ff5500;"> E2 34 A1 C8 23 FB </span>}

    <span style="font-weight:bold;">condition</span>:
        <span style="color:#0057ae;">$my_text_string</span> <span style="font-weight:bold;">or</span> <span style="color:#0057ae;">$my_hex_string</span>
}

<span style="color:#898887;">// External variables</span>

<span style="font-weight:bold;">rule</span> <span style="color:#644a9b;">ExternalVariableExample1</span>
{
    <span style="font-weight:bold;">condition</span>:
       ext_var == <span style="color:#b08000;">10</span>
}

<span style="font-weight:bold;">rule</span> <span style="color:#644a9b;">ExternalVariableExample2</span>
{
    <span style="font-weight:bold;">condition</span>:
       bool_ext_var <span style="font-weight:bold;">or</span> <span style="font-weight:bold;">filesize</span> &lt; int_ext_var
}

<span style="font-weight:bold;">rule</span> <span style="color:#644a9b;">ExternalVariableExample3</span>
{
    <span style="font-weight:bold;">condition</span>:
        string_ext_var <span style="font-weight:bold;">contains</span> <span style="color:#bf0303;">&quot;text&quot;</span>
}

<span style="font-weight:bold;">rule</span> <span style="color:#644a9b;">ExternalVariableExample4</span>
{
    <span style="font-weight:bold;">condition</span>:
        string_ext_var <span style="font-weight:bold;">matches</span> <span style="color:#ff5500;">/</span><span style="color:#3daee9;">[a-z]</span><span style="color:#3daee9;">+</span><span style="color:#ff5500;">/</span>
}

<span style="font-weight:bold;">rule</span> <span style="color:#644a9b;">ExternalVariableExample5</span>
{
    <span style="font-weight:bold;">condition</span>:
        <span style="color:#898887;">/* case insensitive single-line mode */</span>
        string_ext_var <span style="font-weight:bold;">matches</span> <span style="color:#ff5500;">/</span><span style="color:#3daee9;">[a-z]</span><span style="color:#3daee9;">+</span><span style="color:#ff5500;">/is</span>
}

<span style="color:#898887;">// Including files</span>

<span style="font-weight:bold;">include</span> <span style="color:#bf0303;">&quot;other.yar&quot;</span>
<span style="font-weight:bold;">include</span> <span style="color:#bf0303;">&quot;./includes/other.yar&quot;</span>
<span style="font-weight:bold;">include</span> <span style="color:#bf0303;">&quot;../includes/other.yar&quot;</span>
</pre></body></html>
